Blog
Microsoft Teams Helpdesk Impersonation Chains to AD CS ESC1: 400+ Enterprises Breached — Is Yours Next?
Attackers pose as IT support on Microsoft Teams, exploit AD CS ESC1 misconfigurations to forge admin certificates, and drain company data — 400+ enterprises hit in October 2026.
Read More →CVE-2026-58115 (CVSS 10.0): Node-RED Zero-Auth RCE on Siemens IoT2050 Actively Exploited — Patch Your OT Now
CVE-2026-58115 (CVSS 10.0) gives unauthenticated attackers root-level RCE on Siemens SIMATIC IoT2050 Advanced gateways via Node-RED. Active exploitation confirmed — patch to Industrial OS V4.3.4.1 now.
Read More →CVE-2026-13639 & CVE-2026-13684 (CVSS 9.8): C3RB3R Ransomware Is Encrypting Synology NAS Devices — Patch DSM Now
C3RB3R ransomware (Cerber family) is actively encrypting Synology NAS devices via CVE-2026-13639 & CVE-2026-13684 (CVSS 9.8). Synology patched these in Sept 2026. Update DSM now — no public decryptor exists.
Read More →CVE-2026-102764 (CVSS 9.3): BeyondTrust Remote Support Now Has a Public Metasploit Exploit — Patch BT26-05-RS Now
CVE-2026-102764 (CVSS 9.3) in BeyondTrust Remote Support is actively exploited by China-nexus ARMORY CASTLE and now has a public Metasploit module. Apply BT26-05-RS immediately.
Read More →CVE-2026-118539: Drupal Commerce Core Access Bypass Actively Exploited — Are Fraudulent Orders Bleeding Your Online Store?
CVE-2026-118539 in Drupal Commerce Core is actively exploited—attackers bypass authorization to place fraudulent orders. Patch to 3.3.13 or 8.x-2.41 immediately.
Read More →CVE-2026-104935 (CVSS 8.6): Three Ivanti Connect Secure Zero-Days Chained for Root Access — Fully Patched VPN Appliances Compromised
Threat actor UTA0576 chained three Ivanti Connect Secure zero-days (CVE-2026-104935, CVSS 8.6) to gain root access on fully patched VPNs. CISA KEV. Patch now to 25.1.1.2+ or 22.8R2.5.
Read More →PHP2Shell (CVE-2026-109618 & CVE-2026-109619, CVSS 9.2): Pre-Auth RCE in PHP Actively Exploited — Is Your Web Stack Safe?
PHP2Shell — CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2) — are two critical pre-auth RCE flaws in PHP core actively exploited in the wild. Patch your stack now.
Read More →CVE-2026-101767 (CVSS 9.8): Oracle EBS SQL Injection Chains to RCE — Attackers Probing Within 7 Days of Patch
CVE-2026-101767 (CVSS 9.8) lets unauthenticated attackers chain SQL injection to RCE on Oracle EBS 12.2.3–12.2.15. Probing began Oct 27 — patch or isolate now.
Read More →CVE-2026-97229 (CVSS 10.0): GitLab CI/CD RCE Actively Exploited — Patch Your Self-Managed Instance Now
CVE-2026-97229 is a CVSS 10.0 RCE in GitLab's CI/CD regex compiler, actively exploited against Alpine Linux and added to CISA KEV. Patch self-managed instances to 19.3.6 or 19.4.2+ immediately.
Read More →CVE-2026-76418 (CVSS 8.6): Cisco ASA & FTD SSL VPN Zero-Day Exploited — 51,000 Devices at Risk
CVE-2026-76418, added to CISA KEV on 29 Oct 2026, lets unauthenticated attackers crash Cisco ASA and FTD SSL VPN gateways. Patch by 1 November 2026.
Read More →